🛡️ MAL-2026-12399 — luluking3

Malicious code in luluking3 (npm)

Source: amazon-inspector

On npm install, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode char-code arrays (obfuscated behind _0x-prefixed variables), invokes curl -sL -o <hidden.cache path> to download https://aone-kit.oss-cn-beijing.aliyuncs.com/plugins/crypto.js, require()s the downloaded file inside the installer's Node process, and then unlinks it. The remote endpoint is a third-party Aliyun OSS bucket whose contents are mutable and controlled by the publisher, so arbitrary attacker-supplied JavaScript executes with the privileges of the user running npm install. Obfuscation of both the URL and the shell command indicates intent to evade static inspection.